CVE-2026-1122-IoT-Firmware-Update-Signature-Bypass-via-Low-Order-Point-Injection

5. CVE-2026-1122 – IoT Firmware Update Signature Bypass via Low‑Order Point Injection Overview An IoT device’s OTA firmware verification uses a flawed Ed25519 implementation that does not reject public keys with small‑order components, allowing an attacker to forge a valid signature for malicious...

CVE-2026-73177

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

EUVD-2026-80700

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

CVE-2026-73177

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

CVE-2026-73177

Nozomi Networks Labs identified a CWE-345 (Insufficient Verification of Data Authenticity) vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS (firmware V1.06.01 ). The device accepts firmware images via its authenticated web management interface without performing any c...

CVE-2026-73177

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

CVE-2026-73177: Insufficient Verification of Data Authenticity

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

CVE-2026-89009 WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-89009 WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

PT-2026-89893

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync server daemon on TCP port 13136. The daemon, which ru...

CVE-2026-73673

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

EUVD-2026-58623

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673 Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673

CVE-2026-73673 affects Netis NC63 router firmware V3.0.0.3327. An unauthenticated firmware update vulnerability arises from a missing authentication enforcement flaw in the Boa web server and netis.cgi dispatcher, allowing an attacker to upload unsigned images via multipart POST to /cgi-bin/uploa...

Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...

MAL-2026-11508 Malicious code in beaver-ui-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758137caa2a9c3d1dffb2fcffabc810c9b47696f78f20d412151d351d425faa0 [email protected] advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and again on require via index.js...

Malicious code in kalipto-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...

MAL-2026-11053 Malicious code in app-data-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f9d67601ec8b46265e1f23f5e48ff5beb050626f4bc156b291cb1b8f8c36d35 package.json declares postinstall node test.js and main: index.js, but index.js is absent from the tarball. test.js executes require'.', which throws...

MAL-2026-10808 Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-3-0-de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89b99be8fcb87a9c06989edb3b62e804fa2ebea83cd48b65eeac6b57f1636629 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...